JP6040194B2 - Access authority processing system, access authority processing method, and program - Google Patents

Description

  The present invention relates to an access authority processing system, an access authority processing method, and a program for processing confidential information such as medical information.

  It is considered that medical information is distributed and secondarily used for statistical analysis. For example, by collecting data in circulation and performing statistical processing, it is possible to detect the disease status of each region and the epidemic status of influenza in a certain year and use it as a reference for future pharmaceutical and public health management. is there.

  Medical information includes various guidelines such as “Guidelines for Information Processing Businesses that Entrust Management of Medical Information (http://www.meti.go.jp/policy/it_policy/privacy/iryouglv2.pdf)” and the Personal Information Protection Law. Need to be stored and distributed in a format that complies with Even for data collected for secondary use such as statistical analysis, it is not appropriate from the viewpoint of personal information protection to store data in a format that identifies individuals. It is also important that the collected data is used for analysis and stored so that individuals are not identified by a third party.

  An anonymization technique is known as a technique that uses a collected data to analyze and use an individual in a format that does not specify an individual. There are various anonymization techniques, but basically, information (name, gender) that identifies an individual is masked or a blurred value is processed. In the case of masking, the personal name is rewritten to a completely different value, and information such as an address is rewritten for each prefecture. In the case of a blurred value, even if the age is 23, if there is only one person who is 23 years old, the value is rewritten so that it is expressed as 20 years old as a whole.

JP 2006-324076 A Patent 4844325

  The anonymization technique enables analysis processing (for example, statistical processing) from information (population) in which personal information is protected. However, when an unlimited number of types of anonymization information (a plurality of types of analysis results generated from) obtained by a plurality of types of anonymization processing for information on one population is provided, one person can make multiple types of anonymization. By obtaining information (or multiple types of analysis results) and analyzing by combining these multiple types of anonymized information (or multiple types of analysis results), anonymized personal information can be narrowed down or guessed Or may be specified. Therefore, there is a demand for a mechanism that prevents personal information that has been anonymized from such analysis from being narrowed down, estimated, or specified.

  The present invention has been made paying attention to the above circumstances, and anonymized personal information is narrowed down, estimated, or specified from the analysis results of plural types of anonymized information generated from one population. It is an object to provide an information processing system, an access authority processing method, and a program.

  In order to achieve the above object, an access authority processing system, an access authority processing method, and a program according to the present invention are configured as follows.

  (1) The access authority processing system refers to a receiving means for receiving an analysis request for anonymized information obtained by anonymization processing, an extraction means for extracting a log based on the analysis request, and a control rule based on the analysis request Providing an analysis result of the anonymized information based on determination of access permission to the anonymized information, determination means for determining whether or not access to the anonymized information is based on the log and the control rule Information providing means.

  (2) Furthermore, the extraction means of the access authority processing system of (1) above extracts an operation log related to the population of the anonymized information based on the analysis request, and the reference means is based on the analysis request. , Referring to the access control rule relating to the population, the determination means determines whether or not access to the anonymized information is possible based on the operation log and the access control rule.

  (3) Further, the operation log of the access authority processing system according to (2) includes information indicating how many types of statistical processing have been performed on one or more types of anonymized information generated from the population. The access restriction rule includes information indicating how many types of statistical processing are allowed for one or more types of anonymization information generated from the population, and permitting access to the anonymization information .

  (4) Further, the information providing means of any one of the access authority processing systems according to (1) to (3) may send the anonymized information to the analysis processing unit based on a determination of permission to access the anonymized information. Request an analysis, receive the analysis result of the anonymized information, and provide the analysis result.

  (5) The access authority processing method receives an analysis request for anonymized information obtained by anonymization processing, extracts a log based on the analysis request, refers to a control rule based on the analysis request, the log and the control Whether to access the anonymized information is determined based on a rule, and an analysis result of the anonymized information is provided based on determination of permission to access the anonymized information.

  (6) The program causes the computer to execute processing of each unit included in any one of the access authority processing systems (1) to (4).

  That is, according to the present invention, it is possible to prevent personal information that has been anonymized from being narrowed down, estimated, or specified from the analysis results of a plurality of types of anonymized information generated from a single population. An access authority processing system, an access authority processing method, and a program can be provided.

  According to the access authority processing system of (1), the access authority processing method of (5), and the program of (6), the first anonymized information requested for analysis based on the log and the control rule When access is permitted and access is permitted, the analysis result of the first anonymized information is provided, so anonymization is performed by a plurality of types of anonymization processes executed on information of one population It is possible to give a restriction to obtaining a plurality of types of analysis results generated from the plurality of types of anonymized information. Thereby, since only limited analysis results are provided, it is possible to prevent an act of collecting the analysis results exceeding the permitted number and restoring the first anonymized information.

  According to the access authority processing system of (2) above, it is possible to restrict access to the anonymized information based on an operation log related to the population of the anonymized information and an access control rule related to the population.

  According to the access authority processing system of (3) above, information indicating how many types of statistical processing have been performed on one or more types of anonymized information generated from the population and generated from the population Access to the anonymized information can be restricted based on information indicating how many types of statistical processing are allowed for one or more types of anonymized information and access to the anonymized information is permitted.

  According to the access authority processing system of (4), since the analysis result of the anonymization information is received when access is permitted, the anonymization information is not provided by providing no analysis result when access is not permitted. It is possible to safely manage confidential information such as medical information.

It is a figure showing a schematic structure of an access authority processing system concerning an embodiment. It is a figure which shows an example of a statistical processing operation log. It is a figure which shows an example of a statistical processing operation log access control rule. It is a figure which shows an example of the processing sequence by the access authority processing system which concerns on embodiment. It is a flowchart which shows an example of log search condition acquisition by the access authority processing system which concerns on embodiment, and a past log search. It is a figure which shows an example of the access determination (ST14) by the access authority processing system which concerns on embodiment.

  Embodiments according to the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram illustrating a schematic configuration of an access authority processing system according to the embodiment. As shown in FIG. 1, the access authority processing system includes an analysis reception GW (Gateway) 1, a data output unit 2, a basic analysis unit 3, a statistical processing operation log storage unit 4, an access control unit 5, and an access control rule storage unit 6. , Anonymized information DB (Data Base) 7 related to age structure, anonymized processed information DB 8 related to regional structure, anonymized processed information DB 9 related to body structure, statistical processing (medical) information DB 10, anonymized processing unit 11 Is provided.

  Here, the detail of each part which comprises an access authority processing system is demonstrated easily. Details of each part will be described later. The analysis reception GW 1 can receive an access (analysis request for medical information, etc.) from an analyst's personal computer or the like via the Internet 12. The data output unit 2 can provide an analysis result (such as a statistical processing result of anonymized medical information) in response to an access (such as a medical information analysis request) from an analyst's personal computer. The basic analysis unit 3 relates to an anonymized information regarding the age structure, anonymized information regarding the regional structure, or a figure structure corresponding to an access (analysis request for medical information, etc.) from an analyst's personal computer or the like. Analyze anonymized information. In addition, although this embodiment demonstrates the anonymization process regarding an age structure, the anonymization process regarding an area structure, and the anonymization process regarding a body structure as a some anonymization process, it is not limited to these, Furthermore, It can also be combined with other anonymization processes.

  The statistical processing operation log storage unit 4 stores the statistical processing operation log (analysis processing operation log) illustrated in FIG. 2 and updates the statistical processing operation log according to the statistical processing operation. The access control rule storage unit 6 stores the statistical processing operation log access control rule (hereinafter, access control rule) shown in FIG. The access control unit 5 responds to access from an analyst's personal computer or the like (medical information analysis request, etc.) based on the statistical processing operation log shown in FIG. 2 and the access control rule shown in FIG. Based on the accessibility determination, the access to the anonymized information regarding the age structure, the anonymized information regarding the regional structure, or the anonymized information regarding the body structure is permitted, and these information based on the inaccessibility determination Do not allow access to The access control rule is stored in the access control rule storage unit 6, and the method of setting the definition in this access control rule is to use the access control rule stored in the access control rule storage unit 6 using SQL (Structured Query Language) or the like. You may edit directly, GUI (Graphical User Interface) etc. may be prepared in analysis reception GW1, and the access control rule memorize | stored in the access control rule memory | storage part 6 from GUI etc. may be edited.

  The statistical processing information DB 10 stores medical information (population information). The anonymization processing unit 11 generates anonymized medical information from the medical information stored in the statistical processing information DB 10 by an anonymization process (arbitrary anonymization process). For example, the anonymization process part 11 produces | generates the medical information by which the anonymization process regarding the age structure was completed from medical information by the anonymization process regarding the age structure with respect to medical information (population information). Moreover, the anonymization process part 11 produces | generates the medical information by which the anonymization process regarding the regional structure was completed from the medical information by the anonymization process regarding the local structure with respect to medical information (population information). The anonymization process part 11 produces | generates the medical information by which the anonymization process regarding the body type structure was completed from medical information by the anonymization process regarding the body type structure with respect to medical information (population information). The anonymization-processed information DB 7 regarding the age configuration stores medical information that has been anonymized regarding the age configuration. The anonymized information DB8 regarding the regional configuration stores medical information that has been anonymized regarding the regional configuration. The anonymized information DB 9 relating to the body configuration stores medical information that has been anonymized relating to the body configuration. The medical information that has been processed by the anonymous company is deleted after the analysis process is completed.

  In this embodiment, an access authority processing system that processes medical information will be described. However, the information to be processed is not limited to medical information, and information that is highly confidential and needs to hide some information. Is applicable.

FIG. 4 is a diagram showing an example of a processing sequence by the access authority processing system shown in FIG. As shown in FIG. 4, the analyst accesses the analysis reception GW1 via the network 12, for example, by a personal computer, and requests a public analysis processing list (ST1). The analysis reception GW1 receives an anonymized information DB (anonymized information DB7 regarding age structure, anonymized information DB8 regarding regional structure, or anonymized information DB9 regarding body structure) in response to an analysis processing request. A search is performed (ST2), and a return of the search result from the anonymized information DB is received (ST3). Further, the analysis reception GW1 searches the basic analysis unit 3 for the presence / absence of the basic analysis function (ST4), and receives the return of the search result (ST5).
When an analyst accesses the analysis reception GW1 via the network 12, for example, by a personal computer and requests an analysis process (anonymization information analysis process) (ST6), the analysis reception GW1 logs based on the analysis process request. Requesting output (when and where from which organization, who wants what kind of anonymized information, what kind of anonymized information is desired) and access control determination are requested (ST8). For example, the access control determination request includes the access source (global IP address (124.5.x.13) and / or domain name), organization name (Xx Laboratories), person in charge (name a), population (national in fiscal year A) Medical information), information processing such as anonymization (medical cost statistics according to regional composition), output form (graph output), and the like. It is assumed that the user has already applied for the use of the analysis reception GW (account registration in the access authority processing system) in advance. In addition, when a label (A-year national medical information) is attached to the population information, log management and access control determination using this label are possible.

  Based on the access control determination request, the access control unit 5 searches for an access control rule stored in the access control rule storage unit 6 (ST9), and receives a search result return (ST10). The access control unit 5 acquires log search conditions (ST11), searches the corresponding log (statistical processing operation log etc.) in the statistical processing operation log storage unit 4 (ST12), and receives a return of the search result. (ST13). The access control unit 5 determines whether access is possible based on the access control rule and the statistical processing operation log (ST14), and transmits the determination result.

  For example, when an analysis processing request includes an analysis processing request for a population (A year national medical information), an access control determination request includes an access control determination request for a population (A fiscal year national medical information), and a population (A year An operation log relating to national medical information is acquired, and an access control rule relating to the population (A year national medical information) is acquired. Thereby, the access control unit 5 determines whether or not access is possible based on the operation log regarding the population (A year national medical information) and the access control rule regarding the population (A year national medical information).

  For example, the operation log relating to the population (A year national medical information) includes information indicating how many types of statistical processing have been performed on one or more types of anonymized information generated from the population. In addition, access to anonymized information is permitted if the access control rules related to the population (A national medical information in fiscal year A) include up to one or more types of statistical processing for one or more types of anonymized information generated from the population. Contains information indicating what to do.

  For example, the operation log includes information indicating that four types of statistical processing have been performed, and information indicating that access to the anonymized information is allowed if the access control rule is up to five types of statistical processing. If included, the access control unit 5 permits access to the anonymized information generated from the population (A-year national medical information). When the operation log includes information indicating that five types of statistical processing have been performed, and the access control rule includes information indicating that access to the anonymized information is permitted if up to five types of statistical processing are performed If the next statistical process is not the sixth type of statistical process, the access control unit 5 permits access to the anonymized information generated from the population (national medical information in fiscal year A), and the next statistical process In the case of the sixth type of statistical processing, access to the anonymized information generated from the population (national medical information in fiscal year A) is not permitted. Further, the access control rule may include a conditional statement “until the past”. For example, when the access control rule includes a conditional statement “during the past year”, the access control unit 5 determines that the next statistical process is not the sixth type of statistical process in the past year. If access to anonymized information generated from a group (A-year national medical information) is permitted and the next statistical process is the sixth type of statistical process in the past year, the population (A-year national medical information) Information) is not allowed to access the anonymized information.

  The analysis reception GW1 receives the determination result from the access control unit 5, and for the anonymized information DB7 regarding the age configuration, the anonymized information DB8 regarding the regional configuration, or the anonymized information DB9 regarding the body configuration, Data extraction according to the analysis processing request is requested (ST16), the return of the extraction result is received (ST17), and basic analysis of the extracted data is requested to the basic analysis unit 3 (ST18). The basic analysis unit 3 analyzes the extracted data, returns the analysis result, and the analysis reception GW1 receives the analysis result (ST19). The analysis reception GW1 provides the analysis result as being viewable via the data output unit 2, and can accept access (viewing) from an analyst's personal computer or the like (ST20).

  For example, the analysis reception GW1 receives the anonymization information generated from the population by the anonymization process, the basic analysis unit 3 analyzes the anonymization information, and the analysis reception GW1 analyzes via the data output unit 2 Provide results as viewable.

  As described above, the analysis result based on the anonymization information is provided only when the access control unit 5 permits access based on the access control rule and the statistical processing operation log. A plurality of types of analysis results based on a plurality of types of anonymized information generated from one population are not provided without limitation. Thereby, the injustice which restores information of a population from a plurality of kinds of analysis results based on a plurality of kinds of anonymized information can be prevented. The default determination of access control may be set to reject all analyzes to ensure safety. Based on the application regarding the use of the analysis reception GW from the user (account registration to the access authority processing system), the system administrator provides definition information for permitting the use of the user who has applied for the access control rule. Set. As a result, the user can use the system.

  FIG. 5 is a flowchart showing an example of log search condition acquisition (ST11) and past log search (ST12) by the access authority processing system shown in FIG. Based on the access control determination request (ST101), the access control unit 5 acquires the analysis processing request content (ST102), and acquires search range definition information (ST103). The analysis processing request content includes a statistical processing operation log component. The search range definition information is a file or table that defines a search range managed separately from the access control rule. The defined contents are [Population, search range], for example, [Population: National A year medical information, search range: 1 year], [Population: Year B x Health insurance association medical information, search Range: 6 months].

  The access control unit 5 acquires the definition file (ST104, YES), sets a search range based on the definition file (ST105), and searches the status etc. from the access log (ST106).

  For example, when the analysis processing request content is an analysis processing request for national medical information for year A and the definition file includes [population: national medical information for fiscal year A, search range: one year], log search is an analysis processing request. The access status and processing status for the national medical information in the past year A from the access source determined from the information of the content request source are searched.

  In addition, if the analysis processing request content is an analysis processing request for medical information in fiscal year C, and the definition file is undefined, the search range is not set, and the log search is the information of the request source of the analysis processing request content The access status and processing status for all past C medical information from the access source determined from the search are searched.

  FIG. 6 is a flowchart showing an example of access determination (ST14) by the access authority processing system shown in FIG.

  The access control unit 5 calls the rule search result and the log search result, and based on the rule search result and the log search result, the number of types of anonymization processing related to the population is within the number of types allowed for the rule. If the number of types is exceeded, it is determined that there is no access authority (ST207).

  Further, based on the rule search result and the log search result, the access control unit 5 proceeds to the next determination if the result regarding the population is a request format described as permitted in the rule (ST203, YES), and the request format Otherwise, it is determined that there is no access authority (ST207).

  Further, based on the rule search result and the log search result, the access control unit 5 moves to the next determination if the access source is a user attribute described as permitted in the rule (ST204, YES). If not, it is determined that there is no access authority (ST207).

  Further, based on the rule search result and the log search result, the access control unit 5 determines that the access source has the access authority if the access source is an individual user described as permitted in the rule (ST205). It is determined that there is no access authority (ST207).

  Hereinafter, a case where the access control of the access authority processing system is not applied will be described, and the effect of the access control of the access authority processing system will be described in contrast to this. If the above access control is not executed, even if access to information of one population is restricted in order to protect personal information, multiple types of anonymization processing can be applied to multiple types of anonymous information. Anonymized information (for example, by combining multiple types of statistical information in various formats) by generating statistical information and analyzing multiple types of statistical information generated from these multiple types of anonymized information ( Personal information) may be guessed or restored.

  For example, as a result of statistical processing of anonymized processing information related to age composition, a result of statistical processing of anonymized processing information related to regional configuration, and a result of statistical processing of anonymized processing information related to body type composition are combined and analyzed, In some cases, it is possible to narrow down, infer or specify personal information that should have been anonymized.

  Since the medical information system of the present embodiment performs the above-described access control, when trying to obtain a plurality of types of statistical information generated from a plurality of types of anonymized information in an attempt to restore anonymized information, Because there are restrictions (for example, as shown in Fig. 3, statistical processing of national medical information for fiscal year A is limited to 5 types, statistical processing of medical information for health insurance associations is limited to 4 types for fiscal year B), the number of limited types exceeded Do not get the results of statistical processing. Thereby, as above-mentioned, it can prevent that the anonymized information (personal information) is narrowed down, guessed, or specified.

  Furthermore, it is possible to combine the embodiment described above with a process of temporarily providing dummy processing and anonymized data.

  Keeping the original medical information in clear text is not appropriate for safety reasons. However, if medical information that has been anonymized in advance by anonymization processing is stored, some of the information included in the original medical information is lost, so that statistical processing is hindered and the use of statistical processing is limited. Can be considered.

  For example, it is assumed that original medical information is not stored, but anonymized medical information related to age structure, anonymized medical information related to regional structure, and anonymized medical information related to body structure are stored To do. In this case, although the safety is improved, for example, when attention is paid to the medical information that has been anonymized regarding the age configuration, outliers are removed for the age configuration, so the accuracy of statistics using the age configuration decreases. Therefore, the use of statistical processing is limited. The same applies to the medical information that has been anonymized regarding the regional configuration and the medical information that has been anonymized regarding the body configuration. Therefore, there is a demand for a technique for safely storing original medical information.

  Therefore, instead of the method of storing the original medical information as it is, the medical information in which the dummy data is mixed by the dummy process is stored, thereby ensuring the safety of the medical information at a certain level. Here, the dummy process will be described. The access authority processing system holds a dummy data management table, selects a dummy process corresponding to medical information (type, etc.) based on the dummy data management table, and includes dummy data from the original medical information based on the selected dummy process. Medical information is generated and medical information including dummy data is stored. Thereby, for example, even if the stored medical information is extracted by a malicious person, dummy data is mixed in the extracted medical information by dummy processing. It is not easy to get information. The dummy data management table includes information designating dummy processing according to the provider of medical information, the type of medical information, and the like.

  When statistical processing (original medical information) is requested, the access authority processing system generates original medical information from medical information including dummy data based on the dummy data management table, anonymizes the original medical information, and makes the anonymous The processed medical information is statistically processed, and statistical results (analysis results) are provided (output). The provision of anonymized medical information is temporary, and the anonymized medical information is deleted after statistical processing. As described above, personal information and the like can be prevented from leaking from medical information.

  Note that all the procedures of the access control, statistical processing (analysis processing), dummy processing, anonymization processing, and the like can be executed by software. For this reason, the above-described processing can be easily realized only by installing and executing this program on a normal computer through a computer-readable storage medium storing a program for executing the above-described processing procedure.

  For example, the access authority processing system (analysis reception GW1) can download the program, store the downloaded program, and complete the installation of the program. Thereby, the access authority processing system (basic analysis unit 3, access control unit 5, etc.) corresponding to the computer can easily realize the processing based on the installed program.

  The access authority processing system can read the program from a computer-readable storage medium, store the read program, and complete the installation of the program. Thereby, the access authority processing system can easily realize the processing based on the installed program.

  In addition, various modifications can be made without departing from the scope of the present invention.

  In short, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

DESCRIPTION OF SYMBOLS 1 ... Analysis reception GW, 2 ... Data output part, 3 ... Basic analysis part, 4 ... Statistical process operation log storage part, 5 ... Access control part, 6 ... Access control rule storage part, 7 ... Anonymization processing regarding age structure Information DB, 8... Anonymized information DB related to regional configuration, 9... Anonymized processed information DB related to body configuration, 10... Statistical processing information DB, 11.

Claims (5)

A receiving means for receiving an anonymized information analysis request obtained by anonymization processing;
Extracting means for extracting a log based on the analysis request;
Reference means for referring to the control rule based on the analysis request;
Determination means for determining whether or not access to the anonymized information is based on the log and the control rule;
An information providing means for providing an analysis result of the anonymized information based on a determination of access permission to the anonymized information;
Equipped with a,
The extraction means extracts an operation log related to a population of the anonymized information based on the analysis request,
The reference means refers to an access control rule regarding the population based on the analysis request,
The determination means is an access authority processing system for determining whether or not access to the anonymized information is possible based on the operation log and the access control rule . The operation log includes information indicating how many types of statistical processing have been performed on one or more types of anonymized information generated from the population,
The access control rule includes information indicating how many types of statistical processing are allowed for one or more types of anonymized information generated from the population, and access to the anonymized information is permitted. 1. Access authority processing system. The information providing means requests an analysis processing unit to analyze the anonymized information based on a determination of access permission to the anonymized information, receives the analysis result of the anonymized information, and provides the analysis result. Item 3. The access authority processing system according to Item 1 or 2 . Accepting an analysis request for anonymized information obtained by anonymization processing,
Based on the analysis request, extract an operation log related to the anonymized information population ,
Selecting an access control rule for the population based on the analysis request;
Determining whether or not access to the anonymized information is based on the operation log and the access control rule,
An access authority processing method that provides an analysis result of the anonymized information based on a determination of access permission to the anonymized information. The program which makes a computer perform the process of each means with which any one of the access authority processing systems of Claim 1 thru | or 3 is provided.

Images